| |||||||||||||
please move this stuff into DNSplease move this stuff into DNSPosted Dec 26, 2008 3:36 UTC (Fri) by TRS-80 (subscriber, #1804)In reply to: please move this stuff into DNS by drag Parent article: SSL man-in-the-middle attacks The point isn't how easy/lazy it is, the point is to avoiding have to trust (now apparently) untrustworthy CAs. Maintaining your own CA (is that what you mean by signing certificate?) might be OK if you're the only user, but asking other people to install your CA is a right pain, and then you have to worry about keeping the CA secure, plus all the regular PKIX hassles of updating certs etc.
(Log in to post comments)
Security problems with CAs Posted Dec 26, 2008 13:21 UTC (Fri) by vonbrand (subscriber, #4458) [Link] Sad fact is that really checking is expensive, and CAs aren't in the business of "wasting" money to then turn a paying customer away... plus certificates are the same whether they are meant to protect (probably not very interesting) email from prying eyes, commercial transactions in the range of a few tens of dollars, or multi-million dollar movements. The association of the "personal" certificate with all sorts of identifying data makes the planned use of those a privacy nightmare. The whole concept is deeply flawed. For an in-depth discussion of the current issues, look at Peter Gutmann's PKI tutorial (a large PDF presentation).
|
|||||||||||||